Quantum Correlations over Long-distances Using Noisy Quantum Repeaters 
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Quantum correlations as the resource for quantum communication can be distributed over long 
distances by quantum repeaters. In this Letter, we introduce the notion of a noisy quantum re- 
peater, and examine its role in quantum communication. Quantum correlations shared through 
noisy quantum repeaters are then characterized and their secrecy properties are studied. Remark- 
ably, noisy quantum repeaters naturally introduce private states in the key distillation scenario, and 
consequently key distillation protocols are demonstrated to be more tolerant. 
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Quantum Key Distribution (QKD) protocols such as 
the Bennett-Brassard 1984 (BB84) [lj have been imple- 
mented in laboratories @, 0] , and become one of the most 
important and promising applications of Quantum Infor- 
mation Theory. QKD is now no longer an experiment but 
an emerging market [4]]. Further investigations on QKD 
protocols will improve their practical performance under 
realistic constraints [5[. To date, QKD reaches about 
100 km in distance with photon sources through opti- 
cal fibers, which however does not yet meet the distance 
standard of present-day communication. 

The communication distance is somehow limited as 
any physical resource carrying quantum states suffer un- 
wanted interactions with environment such as decoher- 
ence and losses during transmission. In this sense, it is 
natural to build a bridge for quantum correlations, for 
instance quantum relay or quantum repeater, to over- 
come the distance limit. Quantum repeaters are in fact 
known to efficiently extend the communication distance 

0] , but unfortunately not feasible within current tech- 
nology since the so-called quantum memory, that stores 
quantum states for a while, is experimentally challenging. 
Nevertheless, there have been remarkable experimental 
results that envisage a feasible quantum memory in the 
near future 

This work is therefore motivated by two perspectives. 
First, a quantum memory in the near future, as being in 
an earlier phase of development, would have a storage- 
time long enough to distribute quantum correlations over 
distances, but not sufficiently long to apply entanglement 
distillation. The next arises from the fact that a practical 
quantum repeater, being contacts to the quantum chan- 
nels, would be susceptible to its surroundings. To be spe- 
cific, as quantum repeaters are connected to one another 
by possibly noisy quantum channels, errors caused by the 
noisy channels will be ported to the quantum state of a 
quantum memory of the repeater, i.e. quantum repeaters 
become noisy. The question we address then is in what 
way do noisy quantum repeaters feature in QKD scenar- 
ios. It is actually not straightforward to conclude that 
the secret key rate decreases, since noise effects do not 
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FIG. 1: Successive applications of A.r . for j = 1, • • • , N at in- 
dividual quantum repeaters allow two honest parties to share 
entangled states. 



always degrade protocols [9]. Indeed, we will show that 
noisy repeaters degrade the power of eavesdropper, called 
Eve. In this Letter, we characterize quantum correlations 
distributed through noisy quantum repeaters, and then 
study distillation of secret key and entanglement. The 
distribution scenario is described in the entanglement- 
based scheme. 

We first briefly review entanglement distribution 
through a single quantum repeater, denoted by R, as- 
suming that all quantum channels are perfect but only 
limited in distance. The distribution scenario follows 
the standard scheme in Ref. [7], as follows. Alice 
first generates the maximally entangled state |0i) where 
|0i ) = (| 00) + |ll))/\/2, keeps the first qubit, and send 
the other one to the repeater. Bob does the same, and 
the repeater then has two qubits in store. The entangle- 
ment swapping (ES) protocol, denoted by A#, is applied 
to the two qubits in store, and afterwards two honest 
parties share the state \(/)i)ab- Here, the protocol Ar is 
composed of Bell-basis measurement on the two qubits 
followed by the public announcement of the measurement 
outcome, in order that two honest parties apply local op- 
erations to rotate the shared state into \4>i). A quantum 
repeater being a quantum device whose physical state is 
described by a density operator, say t]r, as follows, 

Afl(|0i>Ai? ® \4>i)rb) = ® VR- (1) 

It has been presumably of no interest to find out in which 



2 



quantum state a quantum repeater remains. This is be- 
cause of mainly two reasons: as it is seen in (pQ), a repeater 
is factorized out from two honest parties by the Bell-basis 
measurement of the ES protocol, meaning that no secret 
correlations between the repeater and two honest parties 
would be exploited [lQj |. In addition, it is often supposed 
that a repeater stays in a constant state tjr all the time 
not being affected by any change of its surroundings. 

We now turn to the realistic constraints to quantum 
channels and a quantum repeater. First, quantum chan- 
nels are noisy in general, and therefore each of Alice and 
Bob shares mixed states with the repeater. Here we re- 
strict to cases where the mixed state is Bell-diagonal 
in a single-copy level. If it is not the case, two hon- 
est parties can apply local filtering operations such that 



Bell-diagonal states are shared [llj. The filtering oper- 
ation in fact increases the amount of entanglement, in 
terms of entanglement of formation [l2[ , of shared states 
with some probability. Possible errors that may hap- 
pen must be then one of three kinds, phase-shift, bit-flip, 
or both. For each case, the shared state is one of Bell 
states, where |0 2 ) = (1 <8>Z)|0i), |<fe) = (t <S> X)\4>i) and 
|04) = (1 (g) iY)\4>\) with Pauli matrices X, Y", and Z. 

Next, a practical quantum repeater, as a quantum de- 
vice, would react susceptibly to a change of its surround- 
ings. In particular, a quantum memory in the repeater 
interacts with two qubits sent by two honest parties, 
and thus two qubits stored become the effective environ- 
ment of the repeater. Then, suppose that the two-qubit 
state encoded by two honest parties are sent through and 
perturbed in noisy channels. The isomorphism between 
quantum channels and quantum states tells us that all 
the properties of the noisy channels can be found in the 
quantum state that have arrived at the repeater [131 ]. 
This means that, an error caused by noisy channels cor- 
responds to a change in the repeater's environment. In 
terms of noise parameters, when \(j)i)AR and \(j)j)RB are 
shared for some i and j depending on channel properties, 
a repeater would be perturbed according to the noise i 
and j. This is what we mean that a practical quantum 
repeater is noisy. 

We need to clarify here that it is two honest parties who 
prepare and put a repeater in the middle. This means 
that they already know the properties of the repeater, 
how it reacts to each of phase-, bit-, and both errors, and 
is perturbed. As well, the ES protocol in a repeater can- 
not be designed to work by recognizing errors instance per 
instance i.e. which pair of Bell-states is kept, but always 
assumes the ideal case that |0i)ar® \(^i)rb is shared. In 
addition, we only suppose the minimal responsibilities to 
a repeater, performing the ES protocol, and do not con- 
sider cases where repeaters collaborate with two honest 
parties or an eavesdropper. 

After the ES protocol on \<j>i)AR ® \^>j)rb m the re- 
peater, two honest parties share one of Bell states, de- 
noted by \(j)k) where k is completely determined by the 



error kinds i and j. The noisy quantum repeater can also 
be captured by the single index, /c, as follows, 

&R(\<l>i)AR®\<l>j)RB) = \<t>k)AB{(t>k\ <8>77fl(*0- ( 2 ) 

The repeater's quantum state rjR(k) are known to two 
honest parties since they have prepared a repeater. Like- 
wise, in a general case when N noisy quantum repeaters 
are located, Bell-diagonal states will also end up between 
two honest parties, and the shared state would be finally 
of the following form, 
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h(\<l>l) R n -iR n ® \(t>l) R n R n+ i) 
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= Pi\(/)i)ab(^i\ ®m + p2\fo)AB(fo\ <8>r}2 

+ /%|03)ab(</>3| ®r}3 + Al|</>4)ab(</>4| ®*74 (3) 

where rjj is the normalized quantum state of N repeaters 
when two honest parties share \4>j). Interestingly, this is 
exactly the state that has been considered in the context 
of distillation of private states in Ref. [14], except only 
that the states rjj do not belong to Alice and Bob but an 
independent party, repeaters. 

We have characterized quantum states shared through 
noisy repeaters and noisy channels, exploiting the inde- 
pendent party, repeaters, in the shared state. Before 
starting secrecy analysis, we should first introduce the 
important assumption on shared states, that quantum 
states shared by two honest parties are made invariant 
under any permutation of pairs i.e. symmetric states. 
This can be done by random permutations. The quantum 
de Finetti theorem then states that the most general TV- 
symmetric state, i.e. invariant under any permutations, 
p( N ) converges efficiently to the identically and indepen- 
dently distributed (i.i.d.) one, Pabri as ^ becomes a 
very large number [15[. This implies that in the con- 
text of QKD, one does not have to go through the most 
general case of A^-symmetric states Pabr but it suffices 
to consider the i.i.d. one, the so-called collective attacks, 
Pabr UM- The bound for the general security can be ob- 
tained by analyzing collective attacks. In what follows, 
we assume that the number of copies, N, becomes a very 
large number to ensure applicability of the quantum de 
Finetti theorem. 

We now translate the scenario introduced in Ref. [3] 
of distilling private states to that of distilling secret key 
with noisy quantum repeaters. Since repeaters are sup- 
posed to comprise an independent party not belonging to 
two honest parties nor the eavesdropper, errors caused 
by those repeaters have nothing to do with eavesdrop- 
ping strategies and therefore do not have to be necessar- 
ily corrected to distill secret key. This also means that 
the quantum state representing the general security does 
not necessarily correspond to \4>i)ab- As it was pointed 
out in [14j, by introducing a party independent to two 
honest parties and Eve, Eve's purification power can be 
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degraded. All this can be encapsulated by the so-called 
private states, corresponding to the general security, as 
follows, 

JABR = U\^) ab (H^PrU^ (4) 

where pR is a repeater state and U = J2i j Vj)ab{^3\ ® 
Vft J is a unitary operation called twisting. Note that 
a twisting U provides the equivalence class of private 
states. The only difference is that the local assistance 
by A and B in Ref. [14| is replaced with noisy quantum 
repeaters. 

In particular, we take a unitary operation, the untwist- 
ing one in Ref. [16[ that works for a state of the form 
in (|3]) as follows, 

Pabr = U ] (7 AB rU (5) 

where g A b(= iiR [g A br] ) = is a & ain Bel1 " 

diagonal, with 

Ai, 2 = l(\\0m + M\±\\Pm-p2V2\\) 

A 3 ,4 = l(\\foV3+V4l34±\\p3V3-Pm\\), (6) 

where the trace-norm of an operator A has been denoted 
by || A || 0. This untwisting operation shows the phase 
errors that are necessary to be corrected for the Pabr 
to be a private state. Note that repeaters are classically 
correlated with two honest parties in the state <jabr, 
which means that measurement outcomes of two honest 
parties are independent to quantum states of repeaters. 
The relations above ([5]) and ([6]) reveal not only the reason 
why not all errors existing in pabr have to be corrected 
but also how much errors are necessarily to be corrected. 
First, the state that we are aiming to distill is a private 
state, for which as it can be seen in (|4]) the state gab in 
([5|) should be transformed to the state |</>i) by correct- 
ing all errors there, though pab(= ^r[pabr\) may still 
possess some errors. Next, gab has less errors than pab-, 
which can be seen by comparing (3j of pab in ® to Xj 
of gab in (|6]) for j = 1, 2, 3, 4. To be precise, it holds 
that Xj < f3j for j = 2, 3, 4 [H H3|. Therefore, correct- 
ing less errors that exist in gab, two honest parties will 
share secret key related to a private state. The question 
followed is whether key distillation techniques such as ad- 
vantage distillation and the standard one-way distillation 
protocol commute with a twisting operation U. In fact, 
the distillation techniques commute with twisting oper- 
ations [I?], EH and therefore, no more additional step is 
required in the key distillation scenario. The only differ- 
ence in the classical step is that less errors are estimated 
to be corrected. 

We now analyze secrecy properties of quantum states 
in ([3]) shared through noisy repeaters. Measuring Pabr 
in the computational basis, two honest parties are with 



measurement outcomes of probability distribution, 

PAB(hj) = (^AjB I ^ RpABR \ ^AjB ) i (7) 

to which key distillation techniques are then applied. 
Note here the precondition for key distillation, that quan- 
tum state from which secrecy is to be distilled must be 
entangled [10]. In this case, gab in |5]) is the state where 
secrecy is to be extracted, and once the state pabr is 
identified through state tomography, from the relation 
(j6j) it can be easily checked if the state gab is entangled. 
The state gab is entangled if and only if the follows holds 

a 

\fcK-fon\>\fcm + Pm\- (8) 

It is also worth mentioning a sufficient condition: if the 
state pab is entangled, i.e. f3\ — (3% > (3s + ^4, so is gab- 
This is clear from the inequality, P1—P2 < WP1V1 ~ P2V2 1|, 
that holds true for all (3i^ and 771,2- 

We now consider the standard one-way communication 
of error correction and privacy amplification to the mea- 
surement outcomes of the probability distribution ([7|)- A 
lower bound to the one-way secret key rate has been de- 
rived in Refs. [19], > Iab — Iae, where the mutual 
information is denoted by /. It is then straightforward 
to compute the lower bound to the key rate for measure- 
ment outcomes in (O, as follows 

> l-h(x)- IIA^i + A+i^+illMl/i) (9) 

i=l,3 

where h(-) is the binary entropy, x = \\f3\rii + 772 1| and 

Vi = (1 + WPim - Pi+im+iWIWfrm + A+i^+ilDA One 

can see from the security condition (|9]) how the quantum 
states of quantum repeaters are relevant. In the following 
example, we consider the BB84 protocol with noisy quan- 
tum repeaters, and show that noisy quantum repeaters 
make the protocol more tolerant. 

Example. (BB84) In the entanglement-based scheme, 
the shared quantum state in the BB84 protocol is iden- 
tified in a single-copy level as 

Pab = (l-Q) 2 |<M(0i|+Q(l-Q)|</. 2 )<0 2 | 

+Q(i-Q)\h)(<l>3\ + Q 2 \<p4)(M (10) 

where Q is the quantum-bit-error-rate(QBER) [20]. As a 
toy model of noisy quantum repeaters, we here take the 
shield states considered in Ref. [14( as their quantum 
states, 771,3,4 = (ps + Pa)® 1 /'* 1 and g 2 = pf l , where p a(s) 
is the normalized d-dimensional projection operator onto 
asymmetric (symmetric) space. These noisy quantum re- 
peaters, where only 772 is different from the others, can 
be interpreted as being sensitive to phase errors. Then, 
the shared state in a single-copy level can be written as 
follows, 

PABR = (l"Q) 2 |0l)(0l| ®Vl + (l-Q)Q|<fe)(02|®Tfc 

+ (i-Q)Q\h)(h\^m^Q 2 \M(M^m- (n) 
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FIG. 2: The lower bound to the secret key rate is shown for 
different size of repeater states: I = (without repeaters), 
I = 4, and I = 10. 

As we have shown, it suffices to consider errors existing 
in the untwisted state gab in © so that private states 
in (j4j) are to be distilled. The lower bound to the secret 
key rate can be computed from ([9j), and is depicted in 
Fig. [2j When I becomes a very large number, the QBER 
converges to Q = 24.5%, much higher than the known 
bound 11.0% in Ref. [2l|. 

The key distillation technique applying the two-way 
(AD) followed by the one-way key distillation tolerates 
higher values of QBER. This has been completely an- 
alyzed in Ref. [17], which shows that if shared states 
satisfy 

WPm-Ml 2 > WPim + fomWWfom + (12) 

then secret key can be distilled. By this, quantum states 
in a wider range are shown to be distilled to secret key. 
In particular, if rji is orthogonal to 772, i.e. tr [771772] = 0, 
it holds that \\PiT]i + P2V2W = \\P1V1 — remarkably 
meaning that the security condition in ([T2]) coincides to 
the precondition for key distillation ([8]). Therefore, for 
this particular case, all secret correlations derived from 
entangled states gab can be converted to secrecy. To our 
knowledge, this is the first case that entanglement itself 
implies secrecy, although its general connection remains 
open. 

Finally, we would like to mention that noisy quan- 
tum repeaters do not really play a role in distilling 
entanglement. This is because, differently to key dis- 
tillation where secret key rate matters, entanglement 
distillation is concerned with the singlet fidelity F = 
(01 \ ^r[pabr] where quantum repeaters are traced 
out and therefore not considered. However, it would be 
interesting still to characterize errors that pertain to the 
distillation rate of entanglement. 

To conclude, we have characterized quantum correla- 
tions distributed through noisy quantum repeaters, and 
shown that the scenario corresponds to the distillation of 
private states. This helps to close the gap between two 
extreme sides of QKD, one theoretical and the other prac- 
tical. Remarkably, QKD protocols are shown to tolerate 
higher values of QBER by noisy quantum repeaters. Here 
the lesson to practical QKD over long distances, usually 
having higher values of QBER, is that noise effects in- 
dependent to Eve would make more tolerant protocols, 



for instance, where noisy ES protocols are included. In 
addition, although the scheme of quantum repeater intro- 
duced in Ref. [7] is considered, our results can be easily 
generalized to other variant schemes that are basically 
equivalent to that in Ref. Q. 
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